Flowise 跨身份提供商账户接管漏洞分析

漏洞总结：Cross-IdP account takeover via email-only SSO matching 漏洞概述 漏洞类型：跨身份提供商（Cross-IdP）账户接管 根本原因：Flowise 在通过 SSO 登录时，仅使用 字段作为唯一标识符来匹配或创建用户，而忽略了 （身份提供商）信息。 攻击原理： 1. 攻击者使用自己的 SSO 账户（例如 Google）注册，该账户的邮箱地址与受害者的邮箱地址相同。 2. 当受害者尝试使用其 SSO 账户（例如 GitHub）登录时，系统检测到该邮箱已存在。 3. 系统错误地将受害者的登录请求关联到攻击者之前创建的账户上，导致受害者实际上登录到了攻击者的账户中，或者攻击者可以接管受害者的账户。 影响范围 受影响版本： 受影响组件：SSO 登录逻辑（ ） 严重程度：Critical (严重) 修复方案 修复版本： 修复措施**：在用户匹配逻辑中引入 字段。系统现在会检查 和 的组合，确保不同身份提供商的账户不会因邮箱相同而被混淆。 POC 代码 页面中包含以下 POC 代码，演示了攻击者如何利用此漏洞： ```typescript // POC: SSO email-only identity binding (cross-provider account merge) // // Replays the verbatim user-resolution path from: // packages/server/src/enterprise/src/sso/sso.service.ts:138-148 (verifyAndLogin) // packages/server/src/enterprise/src/services/account.service.ts:537-590 (login) // in a self-contained simulator. // --- Constants --- const UserStatus = Object.freeze({ ACTIVE: 'active', INVITED: 'invited', UNVERIFIED: 'unverified', DELETED: 'deleted', }); // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterpri

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Flowise 跨身份提供商账户接管漏洞分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Flowise 跨身份提供商账户接管漏洞分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！